ADDRESSED AWS DEFAULTS RISKS: OIDC, TERRAFORM, AND ANONYMOUS ACCESS TO ADMINISTRATORACCESS

Summary from the TLDR InfoSec newsletter

This post introduces a novel AWS attack in which an attacker can utilize Terraform Cloud to gain AdministratorAccess on an AWS account by only knowing (or guessing) the Terraform OIDC role and AWS account ID of a victim. This attack is possible when an OIDC's role is created with a trust relationship that does not specify a subject key, which previously was the default when creating a Federated Identity using the GUI. AWS has addressed this vulnerability by adding a mandatory Organization field that becomes the subject field when creating a Federated Identity using the GUI. This post suggests a Lambda strategy that defenders can use to periodically scan for this vulnerability.